The present disclosure relates generally to information handling systems, and more particularly to the storage and retrieval of event logs from information handling systems.
As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.
Some information handling systems generate event logs that provide a record of the alerts and/or notifications in the information handling system. For example, server devices may generate server event logs (SELs), and an entry in an SEL may be generated for any significant occurrence in the server device (or an application/program running on the server device) that requires a user of the server device to be notified or otherwise requires the entry to be added to the SEL. SEL entries may be classified by type (e.g., information events, warning events, error messages, success audit events, failure audit events, and/or other events known in the art), and may include a date of the event, a time of the event, a user logged in to the server device when the event occurred, an identifier for the server device, an event identifier that specifies the event type, a source of the event, and/or a variety of other SEL information known in the art. When available, SELs can be used by an administrator or customer support representative to identify and diagnose the source of existing problems in the server device, as well as possible future problems with the server device. SELs are typically viewed via an event viewer tool such as, for example, the WINDOWS® Event Viewer, a Command-Line tool such as wevtutil, and/or other event viewer tools known in the art.
However, in some situations, the SELs may not be available to an administrator or customer support representative. For example, when a motherboard in a server device fails or otherwise becomes unavailable (e.g., resulting in a device “hang”, “crash”, “hardware lockup”, or other unavailability issue known in the art), there may be no capability to retrieve and view the SELs generated prior to that failure/unavailability. For example, a remote access controller on the failed/unavailable motherboard may be unreachable or unbootable, and the logs stored with that remote access controller may thus be unavailable as well (e.g., restart of the service processor in the remote access controller can be unpredictable when there is a hardware malfunction.) Furthermore, while this lack of SEL retrieval and viewing capability may be due to hardware/software issues like those discussed above, it may also occur due to privacy/security policies that prevent extraction of information from a motherboard that has been removed from a server device of a customer and replaced with a new motherboard. As such, an administrator or technical support representative is typically unable to view the SELs generated prior to motherboard failure/unavailability and/or removal/replacement, which limits the ability to detect and/or determine the issues that may have caused the failure/unavailability and/or resulted in the need to remove/replace that motherboard. As such, motherboards may be removed and replaced in situations where doing so may not necessarily be required, and identification of the issue that caused the failure/unavailability and/or removal/replacement may not be possible, or may take longer than it would if the SELs were available for analysis.
Accordingly, it would be desirable to provide an improved server event log storage and retrieval system.